linux-kernel - Re: BUG: unable to handle kernel paging request from pty

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 26 Feb 2016 16:34:44 +0000
From:	Greg KH <gregkh@...uxfoundation.org>
To:	Jiri Slaby <jslaby@...e.cz>
Cc:	Linus Torvalds <torvalds@...ux-foundation.org>,
	Peter Hurley <peter@...leysoftware.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	stable <stable@...r.kernel.org>, <lwn@....net>,
	Steven Rostedt <rostedt@...dmis.org>
Subject: Re: BUG: unable to handle kernel paging request from pty_write [was: Linux 4.4.2]

On Fri, Feb 26, 2016 at 10:50:27AM +0100, Jiri Slaby wrote:
> On 02/26/2016, 10:23 AM, Jiri Slaby wrote:
> > On 02/26/2016, 09:56 AM, Jiri Slaby wrote:
> >>> I really don't see how it would happen here - that code doesn't look
> >>> particularly odd.
> > 
> > Funnily enough, this is what I got today, when booting 4.4.2 in qemu VM
> > on my host.
> > 
> > RIP crashing (ffffffff810f28d5) is action->dev_id dereference in
> > handle_irq_event_percpu. Look:
> >    0xffffffff810f28d5 <+101>:   mov    0x8(%rbx),%rsi
> >    0xffffffff810f28d9 <+105>:   mov    %r12d,%edi
> >    0xffffffff810f28dc <+108>:   callq  *(%rbx)
> > which is
> >        trace_irq_handler_entry(irq, action);
> >        res = action->handler(irq, action->dev_id);
> >        trace_irq_handler_exit(irq, action, res);
> > 
> ...
> > So is this the same bug or not?
> 
> Seems not, actually. I think I need:
> commit 570540d50710ed192e98e2f7f74578c9486b6b05
> Author: Thomas Gleixner <tglx@...utronix.de>
> Date:   Wed Jan 13 14:07:25 2016 +0100
> 
>     genirq: Validate action before dereferencing it in
> handle_irq_event_percpu()

That's in my queue to pick up later today, sorry about that.

greg k-h